Specification of security standards in contracts with suppliers and service providers regarding NIS2

Standardization of Security Requirements in Contracts with Suppliers and Service Providers Regarding NIS2

In every contractual relationship with suppliers and service providers, security standards are indispensable to meet the requirements of the NIS2 Directive and ensure the security of information and communication technologies (ICT) throughout the supply chain. Below are the essential contractual components that help ensure cybersecurity.

Compliance with the NIS2 Directive

2.1 Obligation to NIS2 Compliance

Requirement: Every supplier and service provider that provides essential or important services must demonstrate compliance with the NIS2 Directive.
 
Obligation: All relevant security measures of the NIS2 Directive must be implemented and evidenced upon request.

Risk Analysis and Risk Management

3.1 Conducting Risk Analyses

Requirement: Regular risk analyses concerning the security of ICT systems must be conducted.
 
Obligation: The results of these analyses must be made available to the client, and necessary risk mitigation measures must be implemented.

3.2 Risk Management Procedures

Requirement: Implementation of a risk management procedure that aligns with the NIS2 Directive.
 
Obligation: Ongoing improvements to security measures based on analysis results and new threats.

Security Measures

4.1 Security Controls and Measures

Requirement: Appropriate technical and organizational measures must be implemented, such as firewalls, IDS (Intrusion Detection Systems), encryption, and regular software updates.
 
Obligation: Ensure regular patches and effective security technologies.

4.2 Access Control

Requirement: Strict access control measures for systems and data must be in place.
 
Obligation: Access is restricted to authorized personnel only, with regular review and documentation of permissions.

Incident Reporting Requirements

5.1 Immediate Reporting of Security Incidents

Requirement: All incidents affecting the security of systems and that could impact the client must be reported immediately.
 
Obligation: The first notification must be made within 24 hours of detection, followed by a complete report within one week.

5.2 Cooperation in Incident Handling

Requirement: Close cooperation in investigating and resolving security incidents.
 
Obligation: Provide all necessary information and resources to contain the incident and prevent future occurrences.

Security Audits and Reviews

6.1 Regular Security Audits

Requirement: Regular audits conducted by the client or an appointed auditor.
 
Obligation: Report findings and quickly implement corrective measures if necessary.

6.2 Audit Rights

Requirement: The client has the right to conduct audits to verify compliance with NIS2 requirements.
 
Obligation: Access to relevant documents, systems, and facilities must be granted.

Training and Awareness

7.1 Personnel Training

Requirement: Regular training of personnel on cybersecurity standards and NIS2.
 
Obligation: Conduct training at least annually, with evidence provided upon request.

7.2 Threat Awareness

Requirement: Programs to raise awareness of current threats must be implemented.
 
Obligation: Ensure that employees are prepared for threats and capable of responding appropriately.

Penalties and Liability

8.1 Penalties for Non-Compliance

Requirement: Penalty clauses for failure to comply with security standards or reporting obligations.
 
Obligation: Penalties to compensate for potential losses due to security breaches.

8.2 Liability

Requirement: Liability for damages resulting from non-compliance with the contractual standards.
 
Obligation: Purchase of insurance policies covering potential compensation claims.

Final Provisions

9.1 Regular Review and Adaptation of Standards

Requirement: Ongoing review and adaptation of contractual standards to legal changes or new threat scenarios.
 
Obligation: Compliance with all updated requirements by the supplier or service provider.

9.2 Contract Termination

Requirement: Right to terminate the contract in the event of severe or repeated violations of security standards.
 
Obligation: All confidential information must be securely destroyed or returned upon contract termination.